document_path_support::documentToBsonWithPaths(...) can have asymptotic quadratic runtime complexity:

void documentToBsonWithPaths(const Document& input,
                             const OrderedPathSet& paths,
                             BSONObjBuilder* builder) {
    for (auto&& path : paths) {
        // getNestedField does not handle dotted paths correctly, so instead of retrieving the
        // entire path, we just extract the first element of the path.
        const auto prefix = FieldPath::extractFirstFieldFromDottedPath(path);
        if (!builder->hasField(prefix)) {
            // Avoid adding the same prefix twice.
            input.getField(prefix).addToBsonObj(builder, prefix);
        }
    }
}

The for loop iterates over all values in the paths set, and calls the BSONObjBuilder::hasField(...) function for all of them. That latter function iterates over all fields in the BSONObj until it either finds a field with the same name or iteration reaches the end. But if all items from paths are added to the BSONObjBuilder and all paths are unique, this will have number of paths * number of paths complexity.

While a complete fix is not trivial, we can perform an optimization in case documentToBsonWithPaths is called with an initially empty BSONObjBuilder and we can guarantee that all paths have unique prefixes.